{"id":96049,"date":"2026-04-09T15:24:47","date_gmt":"2026-04-09T12:24:47","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=96049"},"modified":"2026-04-09T15:26:16","modified_gmt":"2026-04-09T12:26:16","slug":"password-123456-exposes-a-dprk-it-worker-network-in-crypto","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/password-123456-exposes-a-dprk-it-worker-network-in-crypto\/","title":{"rendered":"Password &#8216;123456&#8217; exposes a DPRK IT-worker network in crypto"},"content":{"rendered":"<p>North Korean IT specialists have been posing as ordinary developers to join crypto projects they later try to compromise, according to on-chain sleuth ZachXBT.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">1\/ Recently an unnamed source shared data exfiltrated from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions.<\/p>\n<p>I spent long hours going through all of it, none of which has ever been publicly released.<\/p>\n<p>It revealed an intricate\u2026 <a href=\"https:\/\/t.co\/aTybOrwMHq\">pic.twitter.com\/aTybOrwMHq<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2041873508180095032?ref_src=twsrc%5Etfw\">April 8, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>An unnamed source provided the researcher with data from an internal DPRK payments server. The leak included 390 accounts, chat logs and crypto transactions.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cI spent hours studying these data. They have never been published. The scheme turned out to be intricate: fake identities, forged documents and conversion of crypto to fiat at roughly $1m a month,\u201d the expert wrote.<\/em><\/p>\n<\/blockquote>\n<h2 class=\"wp-block-heading\">How the scheme worked<\/h2>\n<p>The computer of one DPRK IT worker, who used the handle Jerry, was compromised. Extracted data included IPMsg chat logs, fake job-seeker profiles and browser history.<\/p>\n<p>Analysis showed that on luckyguys[.]site\u2014an internal payments platform with a Discord-like interface\u2014the fraudsters reported incoming payments to their handlers. The default password\u2014\u201c123456\u201d\u2014was left unchanged for ten users.<\/p>\n<p>Their accounts, ZachXBT found, listed roles, Korean names, cities and coded group names reflecting DPRK IT-worker operations.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">3\/ The site&#8217;s default password was 123456, which remained unchanged for ten users.<\/p>\n<p>The user list included roles, Korean names, cities, and coded group names consistent with DPRK IT worker operations.<\/p>\n<p>Three companies which appeared are currently OFAC sanctioned: Sobaeksu,\u2026 <a href=\"https:\/\/t.co\/rKYS0TR9BL\">pic.twitter.com\/rKYS0TR9BL<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2041873514924577130?ref_src=twsrc%5Etfw\">April 8, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Three companies that appeared in the records\u2014Sobaeksu, Saenal and Songkwang\u2014are sanctioned by <span data-descr=\"U.S. Treasury's Office of Foreign Assets Control\" class=\"old_tooltip\">OFAC<\/span>.<\/p>\n<p>Soon after the investigation was published, luckyguys[.]site went offline.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">Update: The internal DPRK payment site has since been taken down after my post. <\/p>\n<p>However all data was archived in advance. <a href=\"https:\/\/t.co\/9cRdopal5g\">pic.twitter.com\/9cRdopal5g<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2042076218506539413?ref_src=twsrc%5Etfw\">April 9, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h2 class=\"wp-block-heading\">Operational details<\/h2>\n<p>From December 2025 to April 2026 a WebMsg user styling himself Rascal discussed payment transfers and the creation of fake identities in DMs with PC-1234. All transactions ran through, and were approved by, the server admin account PC-1234.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">4\/ Here is one of the WebMsg users &#8216;Rascal&#8217; and their DMs with PC-1234 detailing payment transfers and the use of fraudulent identities from December 2025 through April 2026.<\/p>\n<p>All payments are processed and confirmed through the server admin account: PC-1234.<\/p>\n<p>Addresses in Hong\u2026 <a href=\"https:\/\/t.co\/akyjmTbL5J\">pic.twitter.com\/akyjmTbL5J<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2041873518577774708?ref_src=twsrc%5Etfw\">April 8, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Accounts and goods were paid for via addresses in Hong Kong (their authenticity is still being verified). Since late November 2025 those wallets have received more than $3.5m.<\/p>\n<p>The flow was formulaic: users either sent crypto from an exchange or service, or converted it to fiat via Chinese bank accounts using platforms such as Payoneer.<\/p>\n<h2 class=\"wp-block-heading\">Structure and intrusion attempts<\/h2>\n<p>Drawing on the dataset, ZachXBT reconstructed the network\u2019s organisational chart, including per-user and per-group payouts for December 2025 to February 2026.<\/p>\n<p>Analysis of internal transactions revealed on-chain links to several known DPRK IT-worker clusters. In December 2025 Tether froze one such wallet on <a href=\"https:\/\/forklog.com\/en\/news\/what-is-tron-trx\">TRON<\/a>.<\/p>\n<p>Jerry\u2019s compromised device showed VPN usage and a trove of fabricated resumes.<\/p>\n<p>In an internal Slack, a user called Nami shared a blog post about a DPRK IT-worker <a href=\"https:\/\/forklog.com\/en\/news\/what-is-a-deepfake\">deepfake<\/a> job applicant. One colleague asked whether it was them; another noted they were not allowed to forward external links.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">8\/ Jerry&#8217;s compromised device shows usage of Astrill VPN and various fake personas applying for jobs.<\/p>\n<p>An internal Slack showed &#8216;Nami&#8217; sharing a blog post about a DPRK IT worker deepfake job applicant. A second user asked if it was them, while a third noted they aren&#8217;t allowed to\u2026 <a href=\"https:\/\/t.co\/7ZdGbX91WT\">pic.twitter.com\/7ZdGbX91WT<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2041873539998085555?ref_src=twsrc%5Etfw\">April 8, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Jerry actively discussed with another DPRK IT worker the possibility of stealing funds from Arcano (a game on GalaChain) via a Nigerian proxy. It is unclear whether the attack was ever carried out.<\/p>\n<h2 class=\"wp-block-heading\">Training and threat level<\/h2>\n<p>From November 2025 to February 2026 the administrator sent the group 43 Hex-Rays\/IDA Pro training modules. The coursework covered <span data-descr=\"a translator that converts machine code, object files or library modules into assembly-language text\" class=\"old_tooltip\">disassembly<\/span>, <span data-descr=\"the process of transforming compiled machine code or bytecode back into readable high-level source code (C++, Java, Python)\" class=\"old_tooltip\">decompilation<\/span>, local and remote debugging, and other aspects of cybersecurity.<\/p>\n<p>ZachXBT noted that this DPRK IT group is less sophisticated than AppleJeus and TraderTraitor, which operate more effectively and pose the main threat to the industry.<\/p>\n<p>He had previously estimated the earnings of North Korean developers at several million dollars a month, and the latest data corroborate those figures.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cMy unpopular opinion: hackers are missing out by not attacking low-level DPRK groups. The risk is low, competition is almost non-existent, and the targets may be worth it,\u201d the on-chain detective emphasised.<\/em><\/p>\n<\/blockquote>\n<h2 class=\"wp-block-heading\">How to spot a North Korean hacker<\/h2>\n<p>A video from a job interview recently went viral on X, in which a DPRK IT worker was asked to insult the country\u2019s leader, Kim Jong Un.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Here is a video of a North Korean IT worker being stopped dead in their tracks upon being required to insult Kim Jong Un.<\/p>\n<p>It won&#8217;t work forever, but right now it&#8217;s genuinely an effective filter. I&#8217;m yet to come across one who can say it. <a href=\"https:\/\/t.co\/8FFVPxNm8X\">https:\/\/t.co\/8FFVPxNm8X<\/a> <a href=\"https:\/\/t.co\/KXI5efMo5L\">pic.twitter.com\/KXI5efMo5L<\/a><\/p>\n<p>\u2014 tanuki42 (@tanuki42_) <a href=\"https:\/\/twitter.com\/tanuki42_\/status\/2041096021300928759?ref_src=twsrc%5Etfw\">April 6, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The candidate did not comply\u2014the picture froze immediately after the request. One reason may be that criticising the leader is a criminal offence in North Korea.<\/p>\n<p>The developer posed as a Japanese man named Taro Aikuchi. The day after the clip was posted he deleted his resumes from LinkedIn and his personal site, and changed his Telegram handle.<\/p>\n<p>In April, <a href=\"https:\/\/forklog.com\/en\/news\/what-is-metamask\">MetaMask<\/a> security researcher Taylor Monahan <a href=\"https:\/\/forklog.com\/en\/news\/north-korean-agents-secretly-developed-code-for-leading-defi-projects-for-seven-years\">said<\/a> that North Korean IT specialists have been getting hired at <a href=\"https:\/\/forklog.com\/en\/news\/what-is-decentralised-finance-defi\">DeFi<\/a> protocols for at least seven years.<\/p>\n<p>Among the projects she highlighted were SushiSwap, Thorchain, Fantom, Shib, Yearn, Floki and many others.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>North Korean IT specialists pose as ordinary developers to join crypto projects they later try to hack, said on-chain sleuth ZachXBT.<\/p>\n","protected":false},"author":1,"featured_media":96050,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Leaked server and '123456' default expose a DPRK IT network infiltrating crypto projects","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1323,1202,1246],"class_list":["post-96049","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-investigations","tag-north-korea-dprk","tag-scammers"],"aioseo_notices":[],"amp_enabled":true,"views":"26","promo_type":"1","layout_type":"1","short_excerpt":"Leaked server and '123456' default expose a DPRK IT network infiltrating crypto projects","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96049","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=96049"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96049\/revisions"}],"predecessor-version":[{"id":96051,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96049\/revisions\/96051"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/96050"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=96049"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=96049"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=96049"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}